Questions tagged [netflow]

For question about the NetFlow protocol.

Filter by
Sorted by
Tagged with
24 votes
4 answers
68k views

What is the difference between netFlow and sFlow?

How is sFlow different from netFlow, and how is each supported by different vendors ?
Benjamin A.'s user avatar
  • 1,687
12 votes
1 answer
2k views

What is the "NDE" interface on a Cisco 6500?

I have a pair of Cisco 6509 routers, which are monitored via SNMP (with Observium, to be accurate). Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a ...
Benjamin A.'s user avatar
  • 1,687
9 votes
3 answers
974 views

ASA Netflow support

Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with ...
henklu's user avatar
  • 799
9 votes
1 answer
3k views

How does NAT Stitching work?

While reading about CISCO NetFlow Analysis I came up with a term named NAT Stitching. I understand Flow Stitching which join same type of inbound and outbound connection. But can't find anything ...
arif's user avatar
  • 603
7 votes
1 answer
3k views

How to get ipfix working with openvswitch? [closed]

I'm trying to monitor my OpenVswitch via IPFix. But I'm banging my head against a brick wall for two days now :/ According to the ovs-vsctl manpage I need to add a new entry into the config-database, ...
Christoph Haefner's user avatar
6 votes
5 answers
912 views

Can netflow be left on all the time?

One of my colleagues and I have gotten into a debate about netflow. He's an old Cisco hand and I've recently joined the cisco ops team after working on Juniper for a few years. The debate is whether ...
Bill K's user avatar
  • 63
5 votes
1 answer
361 views

Mechanisn for performing bandwidth accounting on Cisco routers

We're about to purchase a pair of Cisco 7201s for our edge routers, and some Juniper EX4200s for core. And I'm looking for implement bandwidth accounting for our hosted servers on this hardware (most ...
Geekman's user avatar
  • 1,478
5 votes
0 answers
297 views

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling rate?

Do Juniper MX-series routers support per-interface jFlow/IPFIX sampling? For example, input sampling rate for xe-0/0/1 is one of 100 and input sampling rate for xe-0/0/2 interface is one of 500. I ...
Martin's user avatar
  • 1,177
4 votes
1 answer
290 views

Set of features to characterize DDoS from Netflow data [closed]

I am currently working on a DDoS detection problem from Netflow data from an ISP’s perspective. Very large datasets are available to me for analysis. Though I have done considerable amount of work, ...
PTDS's user avatar
  • 141
3 votes
1 answer
2k views

NetFlow configuration on Catalyst 4500-X

I have a problem with config NetFlow on 4500-X switch. This is NetFlow config flow record NFArecord match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address ...
Vladimir Fomin's user avatar
3 votes
2 answers
915 views

NetFlow-working one direction only

Cisco 3850/IP Base/IOS XE 3.7.2 I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one ...
Rex Sheffield's user avatar
3 votes
2 answers
462 views

Can multiple netflow exporters use same collector port name?

As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple ...
Veerendra K's user avatar
2 votes
2 answers
433 views

Sampled Netflow

i have configured netflow in my router but my router is overheaded. So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as ...
user30276's user avatar
2 votes
1 answer
2k views

Not receiving netflow v9, v5 works - Juniper SRX

We have an ELK Stack running that gathers data and processes it to the point where end users can visualize the data. Right now we're dealing with Syslogs and Netflow, but are experiencing some issues ...
Brayndasilva's user avatar
2 votes
3 answers
3k views

What is a common setting for NetFlow Active Flow Timeout?

What is a common/best practice value for 'active flow time-out' for flow generation from packets. With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src ...
robert's user avatar
  • 121
2 votes
1 answer
196 views

Is there ever a scenario where there would be a 0 length response to an ECHO?

I'm attempting to utilize the flow probe argus to determine "node liveliness"/reachability. I am currently working on handling ICMP status, but would like to derive a method to determine if a ping "...
brandeded's user avatar
  • 135
2 votes
2 answers
4k views

Netflow vs sampled netflow

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times. ...
Jey10's user avatar
  • 180
2 votes
2 answers
420 views

Why is Wireshark unhappy with my Netflow packet sequence numbers?

I wrote a Netflow v10 (IPFIX) traffic generator. It spoofs Source IP addresses to pretend to be coming from multiple sites, and has fake users it sends reports about. The idea is very similar to ...
John's user avatar
  • 135
2 votes
1 answer
262 views

Netflow and Nfsen related question

We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here. If you look at first Bytes(%) column 67.2 G(80.6) so it's in GB what does this means? ...
Satish's user avatar
  • 4,351
2 votes
1 answer
104 views

What is Netflow Scope field?

I was looking at RFC3954, RFC7011 and some Cisco docs - however I can't find the answer for what is the Scope field? What information does it carry?
Verthais's user avatar
2 votes
1 answer
877 views

What field tells me the bytes in IPFIX?

In netflow there are in_bytes and in_pkts fields. What are the equivalent values in IPFIX? I'm shipping IPFIX data with softflowd and I'm getting these fields: destinationIPv4Address ...
red888's user avatar
  • 459
2 votes
1 answer
370 views

The router exports IPFIX data and templates from two different source id

I configure Netflow Flexible use IPFIX protocol on a Cisco router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (source id = 0) and template-sets with ...
Arshen's user avatar
  • 123
2 votes
1 answer
133 views

Cisco top-talker data

I have enabled top-talkers ingress/egress ip flow-top-talkers top 10 sort-by bytes cache-timeout 1 I wanted to confirm a couple things with the output below 1.) When I see a (K), I assume its ...
Jimos's user avatar
  • 23
2 votes
0 answers
100 views

NDE for QoS Flows on SUP720-3C?

I've setup per user Layer 2 policing on a pair of Cat6k with SUP720-3C to rate-limit wireless guest users. This is working fine and the flow table is populated as expected (with L2 QoS flows). Now my ...
Florian Beverborg's user avatar
1 vote
1 answer
568 views

sflow top talker support

I have nexus 9300 switch and i have configured sflow and i want to find out top-talker IP from command line but i am not seeing any command. I have Cisco ASR1k and i have configured netflow and i ...
Satish's user avatar
  • 4,351
1 vote
1 answer
114 views

Netflow V9 field Id range

I am confused about the range of field IDs that are supported in netflow v9. I am getting varied data from online sources from 79, 127, 128. I got the above information from (79) - NetFlow v9 has a ...
Kingkong Jnr's user avatar
1 vote
1 answer
84 views

netflow in unknown on my switch

I am using the 3750G catalyst switch and I want to configure netflow but when I put the first command it appears that netflow is unknown: invalid input detected when i'm using netflow
nafoufa's user avatar
  • 11
1 vote
1 answer
2k views

Netflow on Cisco Catalyst 2960X is not sending data to PRTG

I am using 2 Cisco Catalyst 2960X as a stacked switch and I am trying to set up Netflow on them with PRTG as network monitor but it seems that I'm stuck somewhere, below are the config I'm using: ...
Khanh Nguyen's user avatar
1 vote
1 answer
467 views

Configure jflow v5 get error: interface-name: 'xxx': Must be a services interface

friends: When I configure the jflow v5 on my MX-480: ===== admin@USA-MX-RE0# show forwarding-options sampling instance { MONITOR-FLOW { input { rate 1000; } ...
244boy's user avatar
  • 1,747
1 vote
1 answer
338 views

What is the expected states of a Cisco Netflow entry if it were collected during different stages of a TCP 3-way handshake?

The standard TCP handshake goes: 1. SYN (client->server) 2. SYN+ACK (server->client) 3. ACK (client->server) The NetFlow flags are ORed together and comprise of: URG ACK ...
djp's user avatar
  • 111
1 vote
1 answer
114 views

Where does Netflow get Written to?

I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows ...
SethYes's user avatar
  • 13
1 vote
1 answer
596 views

cisco flow vs ip flow

Using a 2900 series router and I encounter the following issue: hostname#show flow monitor Flow Monitor TESTFLOW: Description: User defined Flow Record: TESTFLOW Flow Exporter: ...
timmeyh's user avatar
  • 221
1 vote
1 answer
1k views

My ASA has decided to stop sending NetFlow traffic. Is there a way to fix this short of restarting?

I have been running NetFlow successfully on all of my ASAs for the past few months. Recently, one of my ASA failover pairs has decided to stop sending netflow packets. Is there a command to restart ...
Peter Grace's user avatar
1 vote
1 answer
532 views

How is start and end time of a flow encoded in Netflow (v9)?

I'm trying to convert AWS VPC Flow Logs into Netflow v9. Each VPC Flow Log record has start and end timestamps that I'd like to encode in a Netflow data record. Looking at the Netflow v9 spec, there ...
sidney's user avatar
  • 113
1 vote
1 answer
2k views

Cisco netflow with nfsen/nfdump

We have Cisco ASR1000 Router and it has following configuration: flow record netflow-record match transport tcp destination-port match transport tcp source-port match transport udp ...
Satish's user avatar
  • 4,351
1 vote
1 answer
90 views

sniffing through my company's lan [closed]

I'm in charge of the network in my company and i have to check the visited websites.We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.DPI (as is it implemented in ...
Andriniaina Andy Nkili Meyong's user avatar
1 vote
0 answers
60 views

Cisco ASA NSEL Template IDs 256-271: Is there a list of names and functions? [closed]

I am trying to interpret Cisco ASA NSEL data, which I understand is similar to Netflow v9 but uses biflow records along with static data templates. I see data templates 256-271 in template frames, and ...
adamotoole's user avatar
1 vote
0 answers
2k views

Huawei: Configuring netstream

I'm trying to configure NETSTREAM, but I'm a little confused. Following this tutorials: Configuring NetStream export and Huawei: NetStream Configuration. I'm configuring netstream on Huawei Ne20e ...
Shinomoto Asakura's user avatar
1 vote
1 answer
2k views

Flexible NetFlow Cisco - define input and output?

I am trying to understand the definition of "input" and "output" traffic to an interface. Below is extracted from Flexible NetFlow Documentation in Cisco 3850 -> If you apply a flow monitor in the ...
Noob's user avatar
  • 529
1 vote
1 answer
198 views

NetFlow working for physical/sub interfaces only?

As far as I know, NetFlow can collect data from physical interfaces and its subinterfaces, right? Not from loopback, VLAN, tunnel or any virtual interface.
human374's user avatar
  • 383
1 vote
1 answer
3k views

NetFlow v9 on Cisco Catalyst 3560 not working

my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work. let me show you the config: flow exporter NETFLOW-EXPORTER destination 10.10.10.12 source Vlan100 transport udp ...
mike.b93's user avatar
  • 203
0 votes
1 answer
555 views

PRTG - NetFlow v9 on Cisco ASA 5520 not working [closed]

We have a PRTG Probe 192.168.4.4 in our office's Domain Controller, and we are trying to configure NetFlow on our leased Cisco ASA 5520 ver 8.2(5) We have done the following on the Cisco: conf t ...
Hadi QJ's user avatar
  • 23
0 votes
2 answers
1k views

Go Back N protocol

I am trying to understand the working of Go-Back N using this website:- http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/ Here, suppose we are sending frames 1,2,3,4,5,6 (window size 4) and in ...
Zephyr's user avatar
  • 421
0 votes
1 answer
257 views

Best practices for IP Flow monitoring [closed]

Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple < source IP, source Port, IP protocol, destination IP, destination Port, source ...
vera's user avatar
  • 201
0 votes
2 answers
86 views

Network report integrated with Active Directory or Users

How can i take network report of bandwidth consumption that integrated with AD or users? I have ASA 5506 and configured netflow 9 with PRTG, I can see the source IP and Destination IPs, Is there any ...
Tech's user avatar
  • 313
0 votes
1 answer
775 views

What does limit a MTU set for an interface? [closed]

The maximum MTU I can set is between 9000 an 10,000 for a Ethernet interface. I have the following message for high values ifconfig eth0 mtu 10000 SIOCSIFMTU: Invalid argument What is the origin ...
user123456's user avatar
0 votes
1 answer
177 views

resolving IP address to FQDN effectively [closed]

We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has ...
tyler durden's user avatar
0 votes
1 answer
316 views

Best practice for configuring sampler rate on Nexus 7000 for Netflow

Is there a best practice for configuring the sampler rate for interfaces that will be sending netflow data. I have tested on our Nexus 7000 with the mode 1 out-of 1000 on interfaces that are seeing ...
The Footsie's user avatar
0 votes
1 answer
180 views

Best practices to build network flow monitoring

Recently I'm investigating the solutions for ip flow monitoring, and come across a lot of pages talking about different solutions and trade-offs between netflow, sflow, IPFIX, etc. In short, netflow/...
lordofire's user avatar
0 votes
0 answers
131 views

read traffic/bandwidth usage by protocol

I need to analyze the traffic of a Fortigate Firewall in my program. Currently, I can read the overall traffic using SNMP. The problem is that I need to analyze the type of traffic (HTTP, video ...
dan1st is on strike's user avatar